CVE-2021-23433

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

• CWE-1321

• https://github.com/algolia/algoliasearch-helper-js/blob/3.5.5/src/SearchParameters/index.js%23L291Broken Link
• https://github.com/algolia/algoliasearch-helper-js/commit/4ff542b70b92a6b81cce8b9255700b0bc0817eddPatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421Exploit, Third Party Advisory
• https://github.com/algolia/algoliasearch-helper-js/blob/3.5.5/src/SearchParameters/index.js%23L291Broken Link
• https://github.com/algolia/algoliasearch-helper-js/commit/4ff542b70b92a6b81cce8b9255700b0bc0817eddPatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421Exploit, Third Party Advisory

Published

Nov 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23428This affects all versions of package elFinder.NetCore. The P…9.8
• CVE-2021-23429All versions of package transpile are vulnerable to Denial o…7.5
• CVE-2021-2343Vulnerability in the Oracle Workflow product of Oracle E-Bus…4.3
• CVE-2021-23430All versions of package startserver are vulnerable to Direct…7.5
• CVE-2021-23431The package joplin before 2.3.2 are vulnerable to Cross-site…8.8
• CVE-2021-23432This affects all versions of package mootools. This is due t…9.8
• CVE-2021-23434This affects the package object-path before 0.11.6. A type c…8.6
• CVE-2021-23435This affects the package clearance before 2.5.0. The vulnera…6.1
• CVE-2021-23436This affects the package immer before 9.0.6. A type confusio…9.8
• CVE-2021-23437The package pillow 5.2.0 and before 8.3.2 are vulnerable to …7.5
• CVE-2021-23438This affects the package mpath before 0.8.4. A type confusio…9.8
• CVE-2021-23439This affects the package file-upload-with-preview before 4.2…6.1